[Suit] FYI: National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems

Dick Brooks <dick@reliableenergyanalytics.com> Thu, 29 July 2021 12:40 UTC

Reply-To: dick@reliableenergyanalytics.com
From: Dick Brooks <dick@reliableenergyanalytics.com>
To: 'suit' <suit@ietf.org>
Date: Thu, 29 Jul 2021 08:39:56 -0400
Organization: Reliable Energy Analytics LLC
Message-ID: <00cb01d78476$d9043d20$8b0cb760$@reliableenergyanalytics.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AdeEdin2Jj/W5rwyRZKRwokoLq+OKg==
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/TGRb8QUVKGZb-uIUz46PzfvT1Vw>
Subject: [Suit] FYI: National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems
Precedence: list

Yesterday, President Biden issued a memorandum titled: National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems 

Link, with commentary:
https://energycentral.com/c/pip/national-security-memorandum-improving-cybersecurity-critical-infrastructure

Link with NO Commentary:
https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/28/national-security-memorandum-on-improving-cybersecurity-for-critical-infrastructure-control-systems/


Thanks,

Dick Brooks

Never trust software, always verify and report! ™
http://www.reliableenergyanalytics.com
Email: dick@reliableenergyanalytics.com
Tel: +1 978-696-1788

-----Original Message-----
From: Suit <suit-bounces@ietf.org> On Behalf Of Michael Richardson
Sent: Saturday, July 24, 2021 3:08 PM
To: suit <suit@ietf.org>
Subject: Re: [Suit] SUIT rechartering: proposed text


Dave Thaler <dthaler=40microsoft.com@dmarc.ietf.org> wrote:
    >> I can think of ways to securely report firmware update status that do
    >> not involve attesting, but if you do attesting (b), then you definitely
    >> do (a), right?

    > You can attest to current state without attesting to the errors that
    > happened the last time you tried to install something.

I agree.
So (a) involves providing feedback on failed attempts to upgrade.

    > (If the errors happened during boot then they may be reported, but
    > post-boot install errors might not be.)

    > And as you mentioned, you can report status (and errors) without attesting.
    > So I think they're complementary items that will often but not always
    > be used together.

I understand now.

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

[Suit] FYI: National Security Memorandum on Impro… Dick Brooks